(* debug = integer between 0 and 3
    0 = merely no log at all, except critical errors and printing the debug
        level itself
    1 = level 0 + positive filtering matches (i.e. when the filter detects
        something to block)
    2 = level 1 + negative filtering matches (i.e. when the filter detects
        that it must not block something)
    3 = level 2 + print all the fetched configuration variables in the filter
        configuration file (modules aliasing, filtered labels, filtered ids,
        ...)
*)
debug = 0

(* wrapping_format_key = configure the AES-128 key used for the wrapping
   format. The format is 32 char long string in hexadecimal format.
   You MUST uncomment and configure to a cryptographically sound random value
   when using the wrapping_format_patch function of the patchset 1 which is the
   default configuration.
*)
wrapping_format_key = "00112233445566778899aabbccddeeff"

(* modules = [(a1, b1), (a2, b2) ...] is a list of couples of strings (a, b)
   with 'a' being an alias, and 'b' being a PATH to the aliased
   PKCS#11 module
*)
modules = [("softhsm", "/usr/local/lib/softhsm/libsofthsm2.so"), ("opencryptoki", "/usr/local/lib/opencryptoki/libopencryptoki.so")]

(* log_subchannel = string representing the filter log subchannel in the server *)
log_subchannel = filter

(* forbidden_mechanisms = [(a1, b1), (a2, b2) ...] is a list of couples where
   'a' is a regular expression string representing modules and 'b' is a list
   of PKCS#11 mechanisms with the PKCS#11 definition syntax (CKM_RSA_X_509 for
   instance)
*)
forbidden_mechanisms = [("sof.*", [CKM_RSA_X_509]), ("opencrypto.*", [])]

(* allowed_labels = [(a1, b1), (a2, b2) ...] is a list of couples where 'a1',
   'a2', ... are regular expression strings representing module names, and
   'b1', 'b2', ... are regular expressions representing labels

   example: allowed_labels  = [("opencryptoki", ["not_filtered_.*", "test"])]
   Here, only objects with CKA_LABEL such as "not_filtered_.*" and "test" are
   usable for the "opencryptoki" alias.

   default: NO filtering, uncomment and configure below to filter objects
*)
(*
allowed_labels  = [("opencryptoki", ["not_filtered_.*", "test"])]
*)

(* allowed_ids = [(a1, b1), (a2, b2) ...] is a list of couples where 'a1',
   'a2', ... are regular expression strings representing module names, and
   'b1', 'b2', ... are regular expressions representing ids

   example: allowed_ids  = [("softhsm", [".*"])]
   Here, this rule allows all CKA_ID to be used for the "softhsm" alias.

   default: NO filtering, uncomment and configure below to filter objects
*)
(*
allowed_ids  = [("softhsm", [".*"])]
*)

(* forbidden_functions = [(a1, b1), (a2, b2) ...] is a list of couples where
   'a1', 'a2', ... are regular expression strings representing module names,
   and 'b1', 'b2', ... are lists of PKCS#11 functions with the PKCS#11 naming
   convention (C_Login, C_Logout ...)

   default OFF, uncomment and configure below to enable;
*)
(*
forbidden_functions  = [("soft.*", []), ("softhsm", [])]
*)

(* enforce_ro_sessions = [(a1, b1), (a2, b2) ...] is a list of couples where
   'a' is a regular expression string representing module names, and 'b1',
   'b2', ... are booleans that can take 'true', 'false', 'yes' and 'no' as
    possible values

   default OFF, uncomment and configure below to enable;
*)
(*
enforce_ro_sessions  = [(".*", no)]
*)

(* forbid_admin_operations = [(a1, b1), (a2, b2) ...] is a list of couples
   where 'a' is a regular expression string representing module names, and
   'b1', 'b2', ... are booleans that can take 'true', 'false', 'yes' and 'no'
   as possible values

   default OFF, uncomment and configure below to enable;
*)
(*
forbid_admin_operations = [(".*", yes)]
*)

(* remove_padding_oracles = [(a1, b1), (a2, b2) ...] is a list of couples where
   'a' is a regular expression string representing module names, and 'b1',
   'b2', ... are a lists of cryptographic operations type that can take as
   possible values 'wrap', 'unwrap', 'encrypt', 'sign' and 'all' (this last
   one represents the sum of all the values)

   default OFF, uncomment and configure below to enable;
*)
(*
remove_padding_oracles = [(".*", [wrap, unwrap, encrypt])]
*)

(* filter_actions = list of couples of [string_regexp x list of couples of
   [PKCS#11_function x custom_function]]). This option is a way to extend
   the filter features as the user can provide its own hooks on every PKCS#11
   function. See FILTER.md for more information.

   default OFF, uncomment and configure below to enable;
*)
(* filter_actions = [
                  (".*", [(C_Login, c_Login_hook), (C_Initialize, c_Initialize_hook)]), 
                  ("soft.*", [(C_CloseSession, identity)])
                 ]
*)

(**** Fixing PKCS#11 with patchset 1 *
   See FILTER.md for a detailed explanation of patchset 1 and 2.

   default ON;
*)
filter_actions_post = [ (".*", 
                          [
                           (******** This is optional: key usage segregation ******************************)
                           (* (C_Initialize, do_segregate_usage), *)

                           (******** Check for key creation and attribute manipulation on non local keys **)
                           (C_CreateObject, non_local_objects_patch),
                           (C_CopyObject, non_local_objects_patch),
                           (C_SetAttributeValue, non_local_objects_patch),

                           (******** Check for value extraction on sensitive/nonextractable keys **********)
                           (C_GetAttributeValue, prevent_sensitive_leak_patch),
                           (C_SetAttributeValue, prevent_sensitive_leak_patch),

                           (******** CryptokiX conflicting attributes patch addendum for existing objects *) 
                           (C_EncryptInit, conflicting_attributes_patch_on_existing_objects),
                           (C_DecryptInit, conflicting_attributes_patch_on_existing_objects),
                           (C_SignInit, conflicting_attributes_patch_on_existing_objects),
                           (C_SignRecoverInit, conflicting_attributes_patch_on_existing_objects),
                           (C_VerifyInit, conflicting_attributes_patch_on_existing_objects),
                           (C_VerifyRecoverInit, conflicting_attributes_patch_on_existing_objects),
                           (C_DeriveKey, conflicting_attributes_patch_on_existing_objects),
                           (C_DigestKey, conflicting_attributes_patch_on_existing_objects),
                           (C_WrapKey, conflicting_attributes_patch_on_existing_objects),
                           (C_UnwrapKey, conflicting_attributes_patch_on_existing_objects),
                           (C_FindObjects, conflicting_attributes_patch_on_existing_objects),

                           (******** Patch addendum to handle key escrow (or not) *)
                           (C_EncryptInit, dangerous_sensitive_keys_escrow_encrypt),
                           (C_DecryptInit, dangerous_sensitive_keys_escrow_encrypt),
                           (C_SignInit, dangerous_sensitive_keys_escrow_encrypt),
                           (C_SignRecoverInit, dangerous_sensitive_keys_escrow_encrypt),
                           (C_VerifyInit, dangerous_sensitive_keys_escrow_encrypt),
                           (C_VerifyRecoverInit, dangerous_sensitive_keys_escrow_encrypt),
                           (C_DeriveKey, dangerous_sensitive_keys_escrow_encrypt),
                           (C_DigestKey, dangerous_sensitive_keys_escrow_encrypt),
                           (C_WrapKey, dangerous_sensitive_keys_escrow_encrypt),
                           (C_UnwrapKey, dangerous_sensitive_keys_escrow_encrypt),
                           (C_FindObjects, dangerous_sensitive_keys_escrow_encrypt),
                             
                           (******** CryptokiX conflicting attributes patch *******************************)
                           (C_CreateObject, conflicting_attributes_patch), (C_CopyObject, conflicting_attributes_patch), 
                           (C_UnwrapKey, conflicting_attributes_patch), (C_GenerateKey, conflicting_attributes_patch), 
                           (C_GenerateKeyPair, conflicting_attributes_patch), (C_DeriveKey, conflicting_attributes_patch), 
                           (C_SetAttributeValue, conflicting_attributes_patch),

                           (******** CryptokiX sticky attributes patch ************************************)
                           (C_CopyObject, sticky_attributes_patch), 
                           (C_SetAttributeValue, sticky_attributes_patch),

                           (******** CryptokiX Wrapping format patch **************************************)
                           (C_WrapKey, wrapping_format_patch), 
                           (C_UnwrapKey, wrapping_format_patch),

                           (******** Sanitizing the creation attributes patch *****************************)
                           (C_CreateObject, sanitize_creation_templates_patch), (C_CopyObject, sanitize_creation_templates_patch), 
                           (C_GenerateKey, sanitize_creation_templates_patch), (C_GenerateKeyPair, sanitize_creation_templates_patch), 
                           (C_DeriveKey, sanitize_creation_templates_patch), (C_UnwrapKey, sanitize_creation_templates_patch) 
                          ]
                   )
                 ]

(**** Fixing PKCS#11 with patchset 2 *
   See FILTER.md for a detailed explanation of patchset 1 and 2.

   default OFF, WARNING patchset 1 and 2 are incompatible, make sure it is not
                enabled before enabling this one
*)
(*
filter_actions_post = [ (".*", 
                          [
                           (******** This is optional: key usage segregation ******************************)
                           (* (C_Initialize, do_segregate_usage), *)

                           (******** CryptokiX conflicting attributes patch addendum for existing objects *) 
                           (C_EncryptInit, conflicting_attributes_patch_on_existing_objects),
                           (C_DecryptInit, conflicting_attributes_patch_on_existing_objects),
                           (C_SignInit, conflicting_attributes_patch_on_existing_objects),
                           (C_SignRecoverInit, conflicting_attributes_patch_on_existing_objects),
                           (C_VerifyInit, conflicting_attributes_patch_on_existing_objects),
                           (C_VerifyRecoverInit, conflicting_attributes_patch_on_existing_objects),
                           (C_DeriveKey, conflicting_attributes_patch_on_existing_objects),
                           (C_DigestKey, conflicting_attributes_patch_on_existing_objects),
                           (C_WrapKey, conflicting_attributes_patch_on_existing_objects),
                           (C_UnwrapKey, conflicting_attributes_patch_on_existing_objects),
                           (C_FindObjects, conflicting_attributes_patch_on_existing_objects),

                           (******** Patch addendum to handle key escrow (or not) *)
                           (C_EncryptInit, dangerous_sensitive_keys_escrow_encrypt),
                           (C_DecryptInit, dangerous_sensitive_keys_escrow_encrypt),
                           (C_SignInit, dangerous_sensitive_keys_escrow_encrypt),
                           (C_SignRecoverInit, dangerous_sensitive_keys_escrow_encrypt),
                           (C_VerifyInit, dangerous_sensitive_keys_escrow_encrypt),
                           (C_VerifyRecoverInit, dangerous_sensitive_keys_escrow_encrypt),
                           (C_DeriveKey, dangerous_sensitive_keys_escrow_encrypt),
                           (C_DigestKey, dangerous_sensitive_keys_escrow_encrypt),
                           (C_WrapKey, dangerous_sensitive_keys_escrow_encrypt),
                           (C_UnwrapKey, dangerous_sensitive_keys_escrow_encrypt),
                           (C_FindObjects, dangerous_sensitive_keys_escrow_encrypt),

                           (******** CryptokiX secure templates patch on key creation and import **********)
                           (C_SetAttributeValue, secure_templates_patch),
                           (C_GenerateKey, secure_templates_patch), (C_GenerateKeyPair, secure_templates_patch),
                           (C_CreateObject, secure_templates_patch), (C_CopyObject, secure_templates_patch),
                           (C_UnwrapKey, secure_templates_patch), (C_DeriveKey, secure_templates_patch),

                           (******** Check for value extraction on sensitive/nonextractable keys **********)
                           (C_GetAttributeValue, prevent_sensitive_leak_patch),
                           (C_SetAttributeValue, prevent_sensitive_leak_patch),

                           (******** Sanitizing the creation attributes patch *****************************)
                           (C_CreateObject, sanitize_creation_templates_patch), (C_CopyObject, sanitize_creation_templates_patch), 
                           (C_GenerateKey, sanitize_creation_templates_patch), (C_GenerateKeyPair, sanitize_creation_templates_patch), 
                           (C_DeriveKey, sanitize_creation_templates_patch), (C_UnwrapKey, sanitize_creation_templates_patch) 
                          ]
                   )
                 ]
*)
